HRMS API and webhooks for developers: Your HR data,
available to your code.
A REST API over the same records the product uses, authenticated with scoped keys, isolated to your organization, versioned and rate limited.
The same records the product uses.
A REST API over your own HR data, and webhooks that tell you the moment something in it changes.
Employees
/v1/employeesRead the directory, create a joiner and update a record. A termination is a status change with a leaving date, never a delete.
Attendance records
/v1/attendancePull raw punches and the computed daily attendance behind them, or post a punch from a device or app of your own.
Leave requests
/v1/leave-requestsList requests with the balance they draw against, raise one on an employee's behalf, or move an existing one through approval.
Payroll runs
/v1/payroll-runsRead a run's period, status and totals. Runs are created, approved and disbursed inside the product, so the API is read-only here.
Payslips
/v1/payslipsFetch the earnings, deductions and net pay lines for an employee in a given run, together with a link to the rendered document.
Departments
/v1/departmentsRead and maintain the department, branch and designation structure the org chart and reporting lines are built from.
Documents
/v1/documentsList employee documents with their expiry dates, or upload a new one against a record. Uploads are scanned before they are stored.
Expense claims
/v1/expense-claimsRead submitted claims and their receipts, raise a claim for an employee, or record an approval decision against one.
Every response is scoped to your own organization, paginated with a cursor and versioned in the path, so an integration written today keeps its shape.
Ask for active employees
curlcurl "$DENWAYS_API_BASE/v1/employees?status=active&limit=2" \
-H "Authorization: Bearer $DENWAYS_API_KEY" \
-H "Accept: application/json"The base URL and the key are both issued to your organization. The key carries only the scopes an admin granted it.
What comes back
200 OK{
"data": [
{
"id": "emp_8f21c4",
"employee_code": "DW-0142",
"full_name": "A. Rahman",
"department": "Finance",
"designation": "Accountant",
"status": "active",
"joined_on": "2024-03-11"
}
],
"page": {
"limit": 2,
"next_cursor": "eyJvIjoyfQ"
}
}Trimmed for the page. Collections are cursor-paginated, so follow next_cursor rather than counting pages.
A key opens one door. Never anybody else's.
API traffic is held to the same controls as the rest of the platform: scoped access, tenant isolation the database enforces itself, and an audit trail on everything that changes.
The key
- Scopes set per key, resource by resource
- Issued, rotated and revoked by an admin
- Rate limited, so one key cannot swamp the API
The tenant
- A key only ever reads its own organization
- Row-Level Security under every query
- Organization IDs in a request are never trusted
The record
- Writes logged with actor, target and timestamp
- TLS everywhere, modern ciphers and HSTS
- Uploads scanned before they are stored
The API runs under the same controls described on the security page. Nothing about it sits outside them.
Getting access
API access is available on every plan from Advance Tracking up. An admin in your organization issues the key, chooses its scopes and can revoke it at any time without disturbing anyone's sign-in.
Compare the plansFull reference documentation
Every endpoint, field, error code and webhook payload is documented, and the account team sends the reference on request so it matches the version your organization is on. You do not need to be a customer to ask for it.
Request the documentationThe full list
What do the API and webhooks include?
10 features across 2 parts of the product, each one built into the application. Where one depends on a plan, a setting or a release, the note under its module says so.
API tokens
A token that acts as the person who created it, with their role, their permissions and their branches.
- Create and revoke
- Name a token and it is shown once. The list shows when each was created, last used and when it expires.
- Lifetimes
- A year for an admin's token, ninety days at most for a manager's. Up to twenty per organization.
- What a token cannot do
- Create other tokens, manage webhooks, change SSO, provisioning or the security policy, export or erase personal data, or delete the organization.
- Logged
- Creation and revocation are on the audit log. Admins see every token, managers their own.
Webhooks
A signed message to your own systems when something they care about happens.
- Events
- Leave approved, candidate hired, and the employee record created from that hire.
- Signed
- Each delivery carries an HMAC-SHA256 signature of the body. The signing secret is shown once.
- Retries
- Up to five attempts, waiting 1, 5, 30 and then 120 minutes.
- Delivery log
- The last hundred deliveries per endpoint with status, attempts, response code and error.
- Send a test
- Fire a test delivery from the page before you rely on it.
- Internal addresses refused
- An endpoint that resolves to a private or loopback address is rejected when saved and again on every attempt.
Questions
Developer questions, answered.
Which plans include API access?
API access is available on every plan from Advance Tracking up. Basic Tracking covers core HR, attendance and leave in the product itself without programmatic access. If you are unsure which plan an integration needs, describe what you want to build and the account team will tell you before you commit.
Where is the full API reference?
The account team provides the complete reference on request, with every endpoint, field, error code and webhook payload. It is not published on this site, so that what you receive matches the version your organization is on. Ask for it during evaluation; you do not need to be a customer first.
Can an API key read another organization's data?
No. Every key belongs to one organization and is scoped to it. That boundary is enforced at the database level with Row-Level Security underneath the application's own authorization checks, and an organization ID supplied in a request is never trusted to decide which tenant's data comes back. A key also carries only the scopes an admin granted it.
How are webhooks delivered, and what happens if our endpoint is down?
Events are sent to an HTTPS endpoint you register, with a signature you verify before trusting the payload. Failed deliveries are retried with a backoff, so a short outage on your side does not lose the event. Build your handler to be idempotent and to key on the event ID, since a retry can deliver the same event more than once.
Is the API versioned, and what happens when it changes?
The API is versioned in the path, so an integration written against a version keeps its shape. Additive changes, such as a new field or event type, can appear within a version, which is why clients should ignore fields they do not recognise. Breaking changes go into a new version, and the account team gives notice before an older one is retired.
Keep reading
Bring your whole workforce onto one platform.
See how DenwaysHR handles HR, attendance and leave across the GCC, and payroll with the WPS file in the UAE.
